The public key should be distributed and installed into /etc/apk/keys on the alpine box that will install the packages. This basically means that the main developer's public keys should be in /etc/apk/keys on all Alpine boxes.